This instalment of the Santa Claus Letters is kindly contributed by in house lawyer, blogger and tweeter @greggio_f.
SNOOPY, RED & BARON LLP
When your privacy counts, you can count on us!
Donner, Blitzen and Rudolf LLP
The Santa Claus Building
St Nicholas Street
The North Pole
21 December 2011
Re: Santa Claus Group and Little Timmy
Data Subject Access Request under s 7 Data Protection Act 1998
We understand that you act for the Santa Claus Group.
We have been instructed by a Mr Timothy Taylor (commonly known as “Little Timmy”) to request, on his behalf and under section 7 of the Data Protection Act 1998, all information regarding Little Timmy held by the Santa Claus Group, including Santa plc, Rudolph Logistics Limited and Elf Enterprises Limited.
In particular, please provide details of:
- All personal data relating to Little Timmy held by the Santa Claus Group;
- Which entity in the Santa Claus Group is the “data controller” in connection with the personal data;
- The purposes for which the personal data are being processed;
- The class of recipients to whom they are being or may be disclosed;
- The physical location(s) at which the personal data is/are being stored and processed; and
- How and from whom the personal data has been or is being collected.
In respect of the identity of the data controller, I note that none of the companies named at paragraph 1 are recorded on the Information Commissioner’s Office (“ICO”) register of data controllers. You should be aware that it is a statutory requirement for organisations that process personal information to notify the ICO of that processing and that failure to notify the ICO may constitute a criminal offence.
In relation to the physical location of the personal data, my client is concerned that his personal data may be being processed outside the EEA, namely at the North Pole. If so, we fail to see how you can be satisfied as to the adequacy of the laws in force in the North Pole with respect to the protection of personal data for the purposes of the eighth data protection principle. We understand that no country currently owns the North Pole or the region of theArctic Oceansurrounding it and accordingly that no such laws are in force.
Notwithstanding the above, our client’s primary concern relates to the means used by the Santa Claus Group to collect the personal information on which it has based its decision that he has not been “good” and should be added to the “naughty list”. Our client maintains that he has not consented to the collection of this personal data, whether directly from him or from a third party.
It has come to our attention in this regard that the Santa Claus Group itself has distributed the following propaganda regarding its principal, a Mr Santa Claus:
“He sees you when you’re sleeping
He knows when you’re awake
He knows if you’ve been bad or good
So be good for goodness sake!”
Our client demands an immediate explanation as to how Mr Claus knows these things. Our client informs us that, with the exception of naps taken during the allotted time in his primary school class and the few occasions he has fallen asleep in the car while returning to his home, he sleeps only in the privacy of his bedroom and with the door and curtains shut. It is reasonable to infer therefore that your client’s knowledge can only have come from (what our client alleges to be unauthorised) access to the confines of his private property.
Our client also has concerns that information about him may have been obtained from unlawful access to his Spiderman phone, the use of surveillance, and/or the records of the responsible authorities that should not have been available to Mr Claus (namely, Little Timmy’s school reports and/or the diaries and correspondence of his legal guardians). You should be aware that he has instructed us to write to the Leveson Inquiry seeking the broadening of its scope to cover activities by bodies such as yourself and that Little Timmy will seek to appear before the Inquiry himself to tell his story.
Finally, our client believes that the information obtained by your client regarding Little Timmy has been or will be used for the purposes of a decision that significantly affects him (namely his eligibility to participate in your client’s annual present delivery programme) based on an automatic processing of that information to evaluate his conduct. We hereby give notice under section 12 of the Data Protection Act 1998 that no such decision may be made based solely on information processed by automatic means and, to the extent any such decision has already been taken, require that the decision is reconsidered or a new decision is taken based on alternative means.
We await your response.
SNOOPY, RED & BARON LLP